- CVSS
- MEDIUM · 5.4v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
- Published
- 2024-07-22
- Weakness
- CWE-476
- Source
- nvd.nist.gov/vuln/detail/CVE-2024-41130
Description
llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in b3427.
References
- https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252
- https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp
- https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252
- https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp
How GTK Cyber trains on this
AI security training at GTK Cyber covers the LLM and ML-pipeline vulnerability classes that vulnerabilities like CVE-2024-41130 fall into. Our hands-on courses are taught by Charles Givre and other practitioners who break and defend production AI systems.